CVE-2026-76975: CWE-79: Improper Neutralization of Input During Web Page Generation in SAP_SE SAPUI5 (Support Assistant Overlay)

This vulnerability arises from improper neutralization of input during web page generation in SAPUI5's Support Assistant Overlay component. Specifically, client-side code reads attacker-controlled input from a malicious link and writes it into the DOM without proper sanitization, enabling DOM-Based XSS. The attacker does not require authentication to create the malicious link but relies on an authenticated user to trigger the exploit. The vulnerability affects confidentiality and integrity within the victim's browser context but does not impact availability.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of an authenticated user's browser session. This can lead to unauthorized access or modification of sensitive information accessible within the browser scope. There is no impact on system availability. No evidence of active exploitation in the wild is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor SAP's security advisories for updates. Until a fix is available, users should exercise caution when clicking on untrusted links and consider implementing client-side mitigations such as Content Security Policy (CSP) where feasible.